The-Accountant-Sep-Oct-2017-Final

PEN OFF
INSIDER THREATS
Is your organization protected?
By FCPA Jim McFie, a Fellow of the Institute of Certified Public Accountants of Kenya
In December 2016, in a seminar at
a hotel in Nairobi, IBM made a
presentation to persons interested in
cyber security; IBM has developed
software that enables banks to
protect themselves against hackers outside
the bank. However, this software does not
protect the bank from insiders. Some days
before that seminar, another computer
software company had presented security
solutions at a workshop; a lady who works
in a bank stated that all young people
who join the bank for which she is the
security officer were involved in stealing:
this is probably an exaggeration: but
today, it is often as important to defend
the organization from staff as it is against
outsiders; and this is the case world-wide.
An insider threat is generally defined as
a current or former employee, contractor,
or other business partner who has or had
authorized access to an organization’s
network, system, or data and intentionally
misused that access to negatively affect
the confidentiality, integrity, or availability
of the organization’s information or
information systems. But often, even
honourable and honest employees can
cause an organization loss of one form or
another.
Building a culture of cyber security
awareness starts at the top. Boards of
directors and C-level executives need
to understand that they ignore cyber
security at their peril and that their
communications to employees about
this topic are a vital piece in building a
security culture. In a recent survey in
the US of IT security executives, 38%
of enterprises reported that their Board
encourages an organizational culture of
information security by identifying and
communicating key risks to employees.
37% reported that Board participation
led to an increase in information
security program funding. The Board’s
involvement makes a difference, and
Board members need to understand
this. With 43% of CEOs seeing cyber
security as a top business risk, the tides
are certainly shifting.
Recent widely publicized security
breaches have certainly contributed to
this mindset. It is important to build on
this awareness by making education a
priority at every level, keeping executives
informed about IT security issues and
making them understand their role in
helping to educate and inform employees.
Cybercriminals do not care about the
size of the entity they attack. Why? If a
small entity has access to the data of a
large enterprise, the small organization
becomes a prime target. In many cases,
small businesses act as customers of
or suppliers to large enterprises and,
therefore, have access to sensitive insider
information. Many small businesses
do not have the time or resources
to combat security threats. As large
enterprises continue to build up their
security perimeter and educate their
employees about what to avoid, smalland
medium-sized enterprises are even
more susceptible to cybercriminals who
are looking at the whole marketplace for
areas of vulnerability. By building a multilayered
security strategy that takes into
66 september - october 2017